Skip to content
Snippets Groups Projects
Commit 301bf5ef authored by Werner Sembach's avatar Werner Sembach
Browse files

Update README and compile.sh

parent 26972322
No related branches found
No related tags found
No related merge requests found
### CVE-2017-8890
Vulnerable kernel version:
- 3.10.105
- 3.18.55
- 4.4.70
vuln in inet_csk_clone_lock in net/ipv4/inet_connection_sock.c
- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/inet_connection_sock.c#L674
mc_list set in ip_mc_join_group in net/ipv4/igmp.c
- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/igmp.c#L1788
freed in sock_close > sock_release > (sock->ops->release) > inet_release in net/ipv4/af_inet.c (found using gdb)
- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/af_inet.c#L427
exact free of mc_list somewhow in ip_mc_drop_socket using kfree_rcu
- https://elixir.bootlin.com/linux/v3.10.105/source/net/ipv4/igmp.c#L2297
Using overwritten function pointer:
- Jop, Rop? How to get arbitrary read/write
### GDB Commands ### GDB Commands
``` ```
aarch64-linux-gnu-gdb linux-3.10.105/vmlinux aarch64-linux-gnu-gdb linux-3.10.105/vmlinux
......
...@@ -4,6 +4,6 @@ SCRIPTDIR=$(dirname "$0") ...@@ -4,6 +4,6 @@ SCRIPTDIR=$(dirname "$0")
cd $SCRIPTDIR/busybox-1.29.3/_install/ cd $SCRIPTDIR/busybox-1.29.3/_install/
cp ../../rcS etc/init.d/rcS cp ../../rcS etc/init.d/rcS
aarch64-linux-gnu-gcc ../../CVE-2017-8890_PoC.c -o CVE-2017-8890_PoC -static -pthread -O0 aarch64-linux-gnu-gcc ../../../MoreFreedomRoot/CVE-2017-8890_PoC.c -o CVE-2017-8890_PoC -static -pthread -O0
aarch64-linux-gnu-gcc ../../test_multicast.c -o test_multicast -static -pthread -O0 aarch64-linux-gnu-gcc ../../test_multicast.c -o test_multicast -static -pthread -O0
find . | cpio -o --format=newc > ../rootfs.img find . | cpio -o --format=newc > ../rootfs.img
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment